@opensip-cli/checks-universal 0.1.0

package/dist/checks/security/cors-configuration.js

@@ -0,0 +1,126 @@
+// @fitness-ignore-file cors-configuration -- Fitness check definition; regex patterns reference CORS tokens for detection purposes, not actual CORS configuration
+/**
+ * @fileoverview Validate CORS configuration follows security best practices
+ */
+import { logger } from '@opensip-cli/core';
+import { defineCheck } from '@opensip-cli/fitness';
+/**
+ * Pre-compiled CORS security patterns for static code analysis.
+ * These patterns are intentional and safe - they are used to detect CORS misconfigurations
+ * in source code, not to parse untrusted user input. The patterns have bounded quantifiers
+ * and do not have catastrophic backtracking issues.
+ */
+// Wildcard origin: origin: "*" or origin = "*"
+const WILDCARD_ORIGIN_PATTERN = /origin\s{0,10}[:=]\s{0,10}(['"])\*\1/g;
+// Wildcard origin with credentials (simplified to avoid backtracking)
+const WILDCARD_WITH_CREDS_PATTERN = /origin\s{0,10}[:=]\s{0,10}(['"])\*\1[^}]{0,200}credentials\s{0,10}[:=]\s{0,10}true/gi;
+// Reflecting origin without validation
+const REFLECTING_ORIGIN_PATTERN = /origin\s{0,10}[:=]\s{0,10}(?:request|req)\.headers?\.origin/gi;
+// All origins allowed
+const ORIGIN_TRUE_PATTERN = /origin\s{0,10}[:=]\s{0,10}true/g;
+// Missing credentials in CORS call (simplified)
+const MISSING_CREDS_PATTERN = /cors\s{0,10}\([^)]{0,500}\)(?![^}]{0,200}credentials)/gi;
+// Patterns that indicate CORS security issues
+const CORS_SECURITY_PATTERNS = [
+    // Wildcard origin
+    {
+        regex: WILDCARD_ORIGIN_PATTERN,
+        message: 'CORS allows wildcard origin - specify allowed origins explicitly',
+        suggestion: 'Replace "*" with an array of allowed origins: origin: ["https://app.example.com", "https://admin.example.com"]. Use environment variables for different environments.',
+        severity: 'error',
+    },
+    // Wildcard origin with credentials
+    {
+        regex: WILDCARD_WITH_CREDS_PATTERN,
+        message: 'CORS wildcard origin with credentials is dangerous - browsers block this combination',
+        suggestion: 'When using credentials: true, you must specify explicit origins. Browsers block wildcard origin with credentials for security.',
+        severity: 'error',
+    },
+    // Reflecting origin without validation
+    {
+        regex: REFLECTING_ORIGIN_PATTERN,
+        message: 'CORS reflecting request origin without validation - validate against allowlist',
+        suggestion: 'Validate the origin against an allowlist before reflecting: const allowedOrigins = new Set([...]); origin: (origin, cb) => cb(null, allowedOrigins.has(origin))',
+        severity: 'error',
+    },
+    // All origins allowed in array
+    {
+        regex: ORIGIN_TRUE_PATTERN,
+        message: 'CORS origin: true reflects any origin - specify allowed origins',
+        suggestion: 'Replace origin: true with an explicit list of allowed origins or a validation function.',
+        severity: 'warning',
+    },
+    // Missing credentials in potentially authenticated context
+    {
+        regex: MISSING_CREDS_PATTERN,
+        message: 'CORS configuration may be missing credentials setting',
+        suggestion: 'If this API uses cookies or Authorization headers, add credentials: true to allow credentialed requests.',
+        severity: 'warning',
+    },
+];
+/**
+ * Check: security/cors-configuration
+ *
+ * Validates CORS configuration is properly restrictive.
+ * Prevents overly permissive cross-origin access.
+ */
+export const corsConfiguration = defineCheck({
+    id: '0ea65e8a-4ee3-43b5-9d7f-dc39fe6fafeb',
+    slug: 'cors-configuration',
+    disabled: true,
+    scope: { languages: ['typescript'], concerns: ['backend', 'server'] },
+    contentFilter: 'raw',
+    confidence: 'medium',
+    description: 'Validate CORS configuration follows security best practices',
+    longDescription: `**Purpose:** Validates that CORS configuration is properly restrictive and does not allow overly permissive cross-origin access.
+
+**Detects:**
+- Wildcard origin: \`origin: "*"\` or \`origin = "*"\`
+- Wildcard origin combined with \`credentials: true\` (browser-rejected but indicates misconfiguration)
+- Reflecting request origin without validation: \`origin: request.headers.origin\`
+- Blanket allow: \`origin: true\`
+- CORS calls potentially missing \`credentials\` setting
+
+**Why it matters:** Overly permissive CORS allows malicious websites to make authenticated requests to your API, enabling CSRF and data theft.
+
+**Scope:** General best practice. Analyzes each file individually. Only scans files containing "cors".`,
+    tags: ['security', 'cors', 'configuration'],
+    fileTypes: ['ts'],
+    analyze(content, filePath) {
+        logger.debug({
+            evt: 'fitness.checks.cors_configuration.analyze',
+            msg: 'Analyzing file for CORS configuration issues',
+        });
+        // Only scan files that might contain CORS config
+        if (!/cors/i.test(content)) {
+            return [];
+        }
+        const violations = [];
+        const lines = content.split('\n');
+        for (const [lineNum, line_] of lines.entries()) {
+            const line = line_ ?? '';
+            // Skip comments
+            if (line.trim().startsWith('//') || line.trim().startsWith('*')) {
+                continue;
+            }
+            for (const pattern of CORS_SECURITY_PATTERNS) {
+                // Reset regex state
+                pattern.regex.lastIndex = 0;
+                const match = pattern.regex.exec(line);
+                if (match) {
+                    violations.push({
+                        line: lineNum + 1,
+                        column: match.index,
+                        message: pattern.message,
+                        severity: pattern.severity,
+                        suggestion: pattern.suggestion,
+                        match: match[0],
+                        filePath,
+                    });
+                }
+            }
+        }
+        return violations;
+    },
+});
+//# sourceMappingURL=cors-configuration.js.map

package/dist/checks/security/cors-configuration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors-configuration.js","sourceRoot":"","sources":["../../../src/checks/security/cors-configuration.ts"],"names":[],"mappings":"AAAA,kKAAkK;AAClK;;GAEG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAuB,MAAM,sBAAsB,CAAC;AAExE;;;;;GAKG;AACH,+CAA+C;AAC/C,MAAM,uBAAuB,GAAG,uCAAuC,CAAC;AACxE,sEAAsE;AACtE,MAAM,2BAA2B,GAC/B,sFAAsF,CAAC;AACzF,uCAAuC;AACvC,MAAM,yBAAyB,GAAG,+DAA+D,CAAC;AAClG,sBAAsB;AACtB,MAAM,mBAAmB,GAAG,iCAAiC,CAAC;AAC9D,gDAAgD;AAChD,MAAM,qBAAqB,GAAG,yDAAyD,CAAC;AAExF,8CAA8C;AAC9C,MAAM,sBAAsB,GAAG;IAC7B,kBAAkB;IAClB;QACE,KAAK,EAAE,uBAAuB;QAC9B,OAAO,EAAE,kEAAkE;QAC3E,UAAU,EACR,uKAAuK;QACzK,QAAQ,EAAE,OAAgB;KAC3B;IACD,mCAAmC;IACnC;QACE,KAAK,EAAE,2BAA2B;QAClC,OAAO,EAAE,sFAAsF;QAC/F,UAAU,EACR,gIAAgI;QAClI,QAAQ,EAAE,OAAgB;KAC3B;IACD,uCAAuC;IACvC;QACE,KAAK,EAAE,yBAAyB;QAChC,OAAO,EAAE,gFAAgF;QACzF,UAAU,EACR,iKAAiK;QACnK,QAAQ,EAAE,OAAgB;KAC3B;IACD,+BAA+B;IAC/B;QACE,KAAK,EAAE,mBAAmB;QAC1B,OAAO,EAAE,iEAAiE;QAC1E,UAAU,EACR,yFAAyF;QAC3F,QAAQ,EAAE,SAAkB;KAC7B;IACD,2DAA2D;IAC3D;QACE,KAAK,EAAE,qBAAqB;QAC5B,OAAO,EAAE,uDAAuD;QAChE,UAAU,EACR,0GAA0G;QAC5G,QAAQ,EAAE,SAAkB;KAC7B;CACF,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,WAAW,CAAC;IAC3C,EAAE,EAAE,sCAAsC;IAC1C,IAAI,EAAE,oBAAoB;IAC1B,QAAQ,EAAE,IAAI;IACd,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE;IACrE,aAAa,EAAE,KAAK;IAEpB,UAAU,EAAE,QAAQ;IACpB,WAAW,EAAE,6DAA6D;IAC1E,eAAe,EAAE;;;;;;;;;;;uGAWoF;IACrG,IAAI,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,eAAe,CAAC;IAC3C,SAAS,EAAE,CAAC,IAAI,CAAC;IAEjB,OAAO,CAAC,OAAe,EAAE,QAAgB;QACvC,MAAM,CAAC,KAAK,CAAC;YACX,GAAG,EAAE,2CAA2C;YAChD,GAAG,EAAE,8CAA8C;SACpD,CAAC,CAAC;QACH,iDAAiD;QACjD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,UAAU,GAAqB,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAElC,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;YAC/C,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YAEzB,gBAAgB;YAChB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAChE,SAAS;YACX,CAAC;YAED,KAAK,MAAM,OAAO,IAAI,sBAAsB,EAAE,CAAC;gBAC7C,oBAAoB;gBACpB,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;gBAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACvC,IAAI,KAAK,EAAE,CAAC;oBACV,UAAU,CAAC,IAAI,CAAC;wBACd,IAAI,EAAE,OAAO,GAAG,CAAC;wBACjB,MAAM,EAAE,KAAK,CAAC,KAAK;wBACnB,OAAO,EAAE,OAAO,CAAC,OAAO;wBACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;wBAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;wBAC9B,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;wBACf,QAAQ;qBACT,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;CACF,CAAC,CAAC"}

package/dist/checks/security/csp-headers.d.ts

@@ -0,0 +1,11 @@
+/**
+ * @fileoverview Validate Content Security Policy headers configuration
+ */
+/**
+ * Check: security/csp-headers
+ *
+ * Validates Content Security Policy headers are properly configured.
+ * Prevents XSS and other injection attacks.
+ */
+export declare const cspHeaders: import("@opensip-cli/fitness").Check;
+//# sourceMappingURL=csp-headers.d.ts.map

package/dist/checks/security/csp-headers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csp-headers.d.ts","sourceRoot":"","sources":["../../../src/checks/security/csp-headers.ts"],"names":[],"mappings":"AAIA;;GAEG;AAqIH;;;;;GAKG;AACH,eAAO,MAAM,UAAU,sCA+DrB,CAAC"}

package/dist/checks/security/csp-headers.js

@@ -0,0 +1,192 @@
+// @fitness-ignore-file no-eval -- String literals referencing eval()/Function() in CSP check descriptions and suggestions, not actual usage
+// @fitness-ignore-file fitness-ignore-validation -- Fitness-ignore directives reference internal check IDs that may not be statically resolvable
+// @fitness-ignore-file file-length-limit -- Complex module with tightly coupled logic; refactoring would risk breaking changes
+// @fitness-ignore-file csp-headers -- Fitness check definition, not production CSP configuration
+/**
+ * @fileoverview Validate Content Security Policy headers configuration
+ */
+import { logger } from '@opensip-cli/core';
+import { defineCheck, isCommentLine } from '@opensip-cli/fitness';
+/**
+ * Match unsafe-inline CSP directive
+ */
+function matchUnsafeInline(line) {
+    logger.debug({
+        evt: 'fitness.checks.csp_headers.match_unsafe_inline',
+        msg: 'Checking for unsafe-inline CSP directive',
+    });
+    return /['"`]unsafe-inline['"`]/i.exec(line);
+}
+/**
+ * Match unsafe-eval CSP directive
+ */
+function matchUnsafeEval(line) {
+    logger.debug({
+        evt: 'fitness.checks.csp_headers.match_unsafe_eval',
+        msg: 'Checking for unsafe-eval CSP directive',
+    });
+    return /['"`]unsafe-eval['"`]/i.exec(line);
+}
+/**
+ * Match wildcard in CSP directive
+ */
+function matchCspWildcard(line) {
+    logger.debug({
+        evt: 'fitness.checks.csp_headers.match_csp_wildcard',
+        msg: 'Checking for wildcard in CSP directive',
+    });
+    const lowerLine = line.toLowerCase();
+    const cspDirectives = ['default-src', 'script-src', 'style-src', 'img-src', 'connect-src'];
+    for (const directive of cspDirectives) {
+        if (lowerLine.includes(directive)) {
+            const match = /['"]\*['"]/i.exec(line);
+            if (match)
+                return match;
+        }
+    }
+    return null;
+}
+/**
+ * Match CSP config missing default-src
+ */
+function matchMissingDefaultSrc(line) {
+    logger.debug({
+        evt: 'fitness.checks.csp_headers.match_missing_default_src',
+        msg: 'Checking for missing default-src CSP directive',
+    });
+    const lowerLine = line.toLowerCase();
+    if (!lowerLine.includes('contentsecuritypolicy'))
+        return null;
+    if (lowerLine.includes('defaultsrc') || lowerLine.includes('default-src'))
+        return null;
+    // @fitness-ignore-next-line sonarjs-regular-expr -- Simple pattern with no backtracking; \s* followed by character class, then literal
+    return /contentSecurityPolicy\s*[:=]\s*\{/i.exec(line);
+}
+/**
+ * Match data: URI in script-src
+ */
+function matchDataUriInScriptSrc(line) {
+    logger.debug({
+        evt: 'fitness.checks.csp_headers.match_data_uri_in_script_src',
+        msg: 'Checking for data URI in script-src directive',
+    });
+    const lowerLine = line.toLowerCase();
+    if (!lowerLine.includes('script-src'))
+        return null;
+    return /['"`]data:['"`]/i.exec(line);
+}
+// Patterns that indicate CSP issues
+const CSP_SECURITY_PATTERNS = [
+    // Unsafe inline scripts
+    {
+        match: matchUnsafeInline,
+        message: "CSP 'unsafe-inline' detected - avoid inline scripts/styles if possible",
+        suggestion: "Use nonces or hashes instead of 'unsafe-inline'. For scripts, use script-src 'nonce-{random}' and add nonce attribute to script tags. For styles, extract to external stylesheets.",
+        severity: 'warning',
+    },
+    // Unsafe eval
+    {
+        match: matchUnsafeEval,
+        message: "CSP 'unsafe-eval' detected - this allows eval() and similar dangerous functions",
+        suggestion: "Remove 'unsafe-eval' and refactor code that uses eval(), new Function(), or setTimeout/setInterval with string arguments. Use proper JSON parsing and precompiled templates.",
+        severity: 'error',
+    },
+    // Wildcard in CSP
+    {
+        match: matchCspWildcard,
+        message: 'CSP wildcard (*) directive detected - use specific origins',
+        suggestion: 'Replace wildcard (*) with specific trusted origins. For images/fonts, list CDN domains explicitly. For API calls, list your API domains.',
+        severity: 'warning',
+    },
+    // Missing default-src
+    {
+        match: matchMissingDefaultSrc,
+        message: 'CSP configuration may be missing default-src directive',
+        suggestion: 'Add default-src: ["\'self\'"] as a fallback policy. This restricts resources to same-origin by default unless overridden by more specific directives.',
+        severity: 'warning',
+    },
+    // data: URI in script-src (dangerous)
+    {
+        match: matchDataUriInScriptSrc,
+        message: "CSP script-src with 'data:' URI is dangerous - can execute arbitrary code",
+        suggestion: "Remove 'data:' from script-src. Data URIs in scripts allow arbitrary code execution, defeating the purpose of CSP. Move scripts to external files or use nonces.",
+        severity: 'error',
+    },
+];
+// Files likely to contain CSP configuration
+const CSP_CONFIG_PATTERNS = ['helmet', 'contentsecuritypolicy', 'content-security-policy', 'csp'];
+/**
+ * Check if content contains CSP configuration references
+ */
+function containsCspContent(content) {
+    logger.debug({
+        evt: 'fitness.checks.csp_headers.contains_csp_content',
+        msg: 'Checking if content contains CSP configuration references',
+    });
+    const lowerContent = content.toLowerCase();
+    return CSP_CONFIG_PATTERNS.some((pattern) => lowerContent.includes(pattern));
+}
+/**
+ * Check: security/csp-headers
+ *
+ * Validates Content Security Policy headers are properly configured.
+ * Prevents XSS and other injection attacks.
+ */
+export const cspHeaders = defineCheck({
+    id: 'ab02c5a5-881d-4004-a655-0ec73944bbe1',
+    slug: 'csp-headers',
+    disabled: true,
+    scope: { languages: ['typescript', 'tsx'], concerns: ['frontend', 'ui'] },
+    contentFilter: 'raw',
+    confidence: 'medium',
+    description: 'Validate Content Security Policy headers configuration',
+    longDescription: `**Purpose:** Validates that Content Security Policy (CSP) headers are configured securely, preventing XSS and code injection attacks.
+
+**Detects:**
+- \`'unsafe-inline'\` in CSP directives (allows inline scripts/styles)
+- \`'unsafe-eval'\` in CSP directives (allows eval() and similar)
+- Wildcard \`*\` in CSP source directives (default-src, script-src, style-src, img-src, connect-src)
+- Missing \`default-src\` in contentSecurityPolicy configuration objects
+- \`data:\` URI in script-src (allows arbitrary code execution)
+
+**Why it matters:** Weak CSP directives undermine the primary browser defense against XSS. A properly configured CSP blocks injected scripts even when other defenses fail.
+
+**Scope:** General best practice. Analyzes each file individually. Only scans files containing helmet, contentSecurityPolicy, or csp references.`,
+    tags: ['security', 'csp', 'headers', 'xss'],
+    fileTypes: ['ts'],
+    analyze(content, filePath) {
+        logger.debug({
+            evt: 'fitness.checks.csp_headers.analyze',
+            msg: 'Analyzing file for CSP header configuration issues',
+        });
+        // Only scan files that might contain CSP config
+        if (!containsCspContent(content)) {
+            return [];
+        }
+        const violations = [];
+        const lines = content.split('\n');
+        for (const [lineNum, line_] of lines.entries()) {
+            const line = line_ ?? '';
+            // Skip comments
+            if (isCommentLine(line)) {
+                continue;
+            }
+            for (const pattern of CSP_SECURITY_PATTERNS) {
+                const match = pattern.match(line);
+                if (match) {
+                    violations.push({
+                        line: lineNum + 1,
+                        column: match.index,
+                        message: pattern.message,
+                        severity: pattern.severity,
+                        suggestion: pattern.suggestion,
+                        match: match[0],
+                        filePath,
+                    });
+                }
+            }
+        }
+        return violations;
+    },
+});
+//# sourceMappingURL=csp-headers.js.map

package/dist/checks/security/csp-headers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csp-headers.js","sourceRoot":"","sources":["../../../src/checks/security/csp-headers.ts"],"names":[],"mappings":"AAAA,4IAA4I;AAC5I,iJAAiJ;AACjJ,+HAA+H;AAC/H,iGAAiG;AACjG;;GAEG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,aAAa,EAAuB,MAAM,sBAAsB,CAAC;AAEvF;;GAEG;AACH,SAAS,iBAAiB,CAAC,IAAY;IACrC,MAAM,CAAC,KAAK,CAAC;QACX,GAAG,EAAE,gDAAgD;QACrD,GAAG,EAAE,0CAA0C;KAChD,CAAC,CAAC;IACH,OAAO,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/C,CAAC;AAED;;GAEG;AACH,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,CAAC,KAAK,CAAC;QACX,GAAG,EAAE,8CAA8C;QACnD,GAAG,EAAE,wCAAwC;KAC9C,CAAC,CAAC;IACH,OAAO,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC7C,CAAC;AAED;;GAEG;AACH,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,CAAC,KAAK,CAAC;QACX,GAAG,EAAE,+CAA+C;QACpD,GAAG,EAAE,wCAAwC;KAC9C,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,aAAa,GAAG,CAAC,aAAa,EAAE,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;IAC3F,KAAK,MAAM,SAAS,IAAI,aAAa,EAAE,CAAC;QACtC,IAAI,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvC,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAS,sBAAsB,CAAC,IAAY;IAC1C,MAAM,CAAC,KAAK,CAAC;QACX,GAAG,EAAE,sDAAsD;QAC3D,GAAG,EAAE,gDAAgD;KACtD,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACrC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,uBAAuB,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9D,IAAI,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC;QAAE,OAAO,IAAI,CAAC;IACvF,uIAAuI;IACvI,OAAO,oCAAoC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzD,CAAC;AAED;;GAEG;AACH,SAAS,uBAAuB,CAAC,IAAY;IAC3C,MAAM,CAAC,KAAK,CAAC;QACX,GAAG,EAAE,yDAAyD;QAC9D,GAAG,EAAE,+CAA+C;KACrD,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACrC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,OAAO,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACvC,CAAC;AAED,oCAAoC;AACpC,MAAM,qBAAqB,GAAG;IAC5B,wBAAwB;IACxB;QACE,KAAK,EAAE,iBAAiB;QACxB,OAAO,EAAE,wEAAwE;QACjF,UAAU,EACR,oLAAoL;QACtL,QAAQ,EAAE,SAAkB;KAC7B;IACD,cAAc;IACd;QACE,KAAK,EAAE,eAAe;QACtB,OAAO,EAAE,iFAAiF;QAC1F,UAAU,EACR,8KAA8K;QAChL,QAAQ,EAAE,OAAgB;KAC3B;IACD,kBAAkB;IAClB;QACE,KAAK,EAAE,gBAAgB;QACvB,OAAO,EAAE,4DAA4D;QACrE,UAAU,EACR,0IAA0I;QAC5I,QAAQ,EAAE,SAAkB;KAC7B;IACD,sBAAsB;IACtB;QACE,KAAK,EAAE,sBAAsB;QAC7B,OAAO,EAAE,wDAAwD;QACjE,UAAU,EACR,uJAAuJ;QACzJ,QAAQ,EAAE,SAAkB;KAC7B;IACD,sCAAsC;IACtC;QACE,KAAK,EAAE,uBAAuB;QAC9B,OAAO,EAAE,2EAA2E;QACpF,UAAU,EACR,kKAAkK;QACpK,QAAQ,EAAE,OAAgB;KAC3B;CACF,CAAC;AAEF,4CAA4C;AAC5C,MAAM,mBAAmB,GAAG,CAAC,QAAQ,EAAE,uBAAuB,EAAE,yBAAyB,EAAE,KAAK,CAAC,CAAC;AAElG;;GAEG;AACH,SAAS,kBAAkB,CAAC,OAAe;IACzC,MAAM,CAAC,KAAK,CAAC;QACX,GAAG,EAAE,iDAAiD;QACtD,GAAG,EAAE,2DAA2D;KACjE,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAC3C,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,WAAW,CAAC;IACpC,EAAE,EAAE,sCAAsC;IAC1C,IAAI,EAAE,aAAa;IACnB,QAAQ,EAAE,IAAI;IACd,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,YAAY,EAAE,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE;IACzE,aAAa,EAAE,KAAK;IAEpB,UAAU,EAAE,QAAQ;IACpB,WAAW,EAAE,wDAAwD;IACrE,eAAe,EAAE;;;;;;;;;;;iJAW8H;IAC/I,IAAI,EAAE,CAAC,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC;IAC3C,SAAS,EAAE,CAAC,IAAI,CAAC;IAEjB,OAAO,CAAC,OAAe,EAAE,QAAgB;QACvC,MAAM,CAAC,KAAK,CAAC;YACX,GAAG,EAAE,oCAAoC;YACzC,GAAG,EAAE,oDAAoD;SAC1D,CAAC,CAAC;QACH,gDAAgD;QAChD,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,UAAU,GAAqB,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAElC,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;YAC/C,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YAEzB,gBAAgB;YAChB,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxB,SAAS;YACX,CAAC;YAED,KAAK,MAAM,OAAO,IAAI,qBAAqB,EAAE,CAAC;gBAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAClC,IAAI,KAAK,EAAE,CAAC;oBACV,UAAU,CAAC,IAAI,CAAC;wBACd,IAAI,EAAE,OAAO,GAAG,CAAC;wBACjB,MAAM,EAAE,KAAK,CAAC,KAAK;wBACnB,OAAO,EAAE,OAAO,CAAC,OAAO;wBACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;wBAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;wBAC9B,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;wBACf,QAAQ;qBACT,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;CACF,CAAC,CAAC"}

package/dist/checks/security/dependency-vulnerability-audit.d.ts

@@ -0,0 +1,15 @@
+/**
+ * @fileoverview Dependency Vulnerability Audit Check
+ *
+ * Runs the project's package-manager audit (pnpm/yarn/npm) and turns
+ * the result into fitness violations. Static-analysis tools like
+ * semgrep ship as separate checks (`semgrep-scan`).
+ */
+/**
+ * Check: security/dependency-vulnerability-audit
+ *
+ * Dependency vulnerability scanning via the project's package
+ * manager.
+ */
+export declare const dependencyVulnerabilityAudit: import("@opensip-cli/fitness").Check;
+//# sourceMappingURL=dependency-vulnerability-audit.d.ts.map

package/dist/checks/security/dependency-vulnerability-audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dependency-vulnerability-audit.d.ts","sourceRoot":"","sources":["../../../src/checks/security/dependency-vulnerability-audit.ts"],"names":[],"mappings":"AACA;;;;;;GAMG;AAQH;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,sCAiGvC,CAAC"}

package/dist/checks/security/dependency-vulnerability-audit.js

@@ -0,0 +1,184 @@
+// @fitness-ignore-file unused-config-options -- Config options reserved for future use or environment-specific
+/**
+ * @fileoverview Dependency Vulnerability Audit Check
+ *
+ * Runs the project's package-manager audit (pnpm/yarn/npm) and turns
+ * the result into fitness violations. Static-analysis tools like
+ * semgrep ship as separate checks (`semgrep-scan`).
+ */
+import { defineCheck } from '@opensip-cli/fitness';
+// =============================================================================
+// CHECK DEFINITION
+// =============================================================================
+/**
+ * Check: security/dependency-vulnerability-audit
+ *
+ * Dependency vulnerability scanning via the project's package
+ * manager.
+ */
+export const dependencyVulnerabilityAudit = defineCheck({
+    id: '4dadedc7-24e6-4e36-b006-3f0ba93d55bb',
+    slug: 'dependency-vulnerability-audit',
+    scope: { languages: ['typescript'], concerns: ['backend'] },
+    confidence: 'medium',
+    description: 'Dependency vulnerability scanning via package manager audit',
+    longDescription: `**Purpose:** Runs dependency vulnerability scanning using the project's package manager (pnpm, yarn, or npm).
+
+**Detects:**
+- Critical and high severity vulnerabilities (reported as errors)
+- Moderate severity vulnerabilities (reported as warnings)
+- Auto-detects package manager from lockfile: pnpm-lock.yaml → pnpm, yarn.lock → yarn, otherwise npm
+
+**Why it matters:** Automated security scanning catches known vulnerabilities in dependencies before they reach production, reducing the attack surface.
+
+**Scope:** General best practice. Runs external tool (\`command\`): auto-detected \`audit --json\`. 3-minute timeout for longer scans.`,
+    tags: ['security', 'compliance', 'quality'],
+    fileTypes: ['ts', 'tsx'],
+    timeout: 180_000, // 3 minutes - security scans take longer
+    command: {
+        // Detect package manager: prefer pnpm > yarn > npm (matches lockfile present in cwd)
+        bin: 'sh',
+        args: [
+            '-c',
+            'if [ -f pnpm-lock.yaml ]; then pnpm audit --json 2>/dev/null; elif [ -f yarn.lock ]; then yarn audit --json 2>/dev/null; else npm audit --json 2>/dev/null; fi; exit 0',
+        ],
+        expectedExitCodes: [0, 1], // audit tools return 1 when vulnerabilities found
+        /* v8 ignore start -- npm audit parse exercised via integration tests (requires lockfile + audit CLI) */
+        parseOutput(stdout, _stderr, _exitCode) {
+            const violations = [];
+            // Parse npm/pnpm audit results.
+            //
+            // The metadata totals roll up EVERY advisory including dev-only
+            // transitive ones (e.g. vitest → vite). Those don't ship to
+            // production. To avoid false-positives on dev-only chains, walk
+            // the per-advisory `findings[].paths[]` and reduce the count to
+            // advisories that have at least one non-dev path.
+            try {
+                const auditResult = JSON.parse(stdout);
+                // Filter to production-affecting advisories. A finding is
+                // production-affecting if it has at least one path whose
+                // `dev` flag is not true. Absence of metadata = treat as
+                // production (conservative).
+                const prodCounts = countProductionAdvisories(auditResult);
+                const count = prodCounts.critical + prodCounts.high + prodCounts.moderate;
+                if (count > 0) {
+                    const severity = getNpmAuditSeverityFromCounts(prodCounts);
+                    violations.push({
+                        line: 1,
+                        message: `npm audit found ${count} production-affecting vulnerabilities`,
+                        severity: severity === 'critical' || severity === 'high' ? 'error' : 'warning',
+                        suggestion: 'Run `npm audit fix` to automatically fix vulnerabilities, or `npm audit` for details. For breaking changes, manually update the affected packages. Dev-only transitive vulnerabilities (e.g. via vitest, eslint) are excluded from this count.',
+                        type: `security-${severity}`,
+                        match: 'npm-audit',
+                        filePath: 'package.json',
+                    });
+                }
+            }
+            catch {
+                // @swallow-ok Ignore parse errors
+            }
+            return violations;
+        },
+        /* v8 ignore stop */
+    },
+});
+/**
+ * Dev-only tooling packages whose transitive vulnerabilities never
+ * reach production. pnpm's `audit --json` does not populate the
+ * per-finding `dev` flag, so we infer dev status from the first hop
+ * of the dependency path.
+ */
+const DEV_ONLY_TOOL_ROOTS = new Set([
+    'vitest',
+    '@vitest/coverage-v8',
+    'eslint',
+    'eslint-plugin-import',
+    'eslint-plugin-sonarjs',
+    'eslint-plugin-unicorn',
+    'eslint-import-resolver-typescript',
+    '@typescript-eslint',
+    'typescript-eslint',
+    'turbo',
+    'knip',
+    'dependency-cruiser',
+    'tsx',
+    'tsup',
+    'jest',
+    '@jest',
+    'ink', // CLI UI testing - dev-time interactive surfaces
+]);
+function isPathProduction(p) {
+    // pnpm format: 'workspace__pkg>dep>subdep'. Split on '>' and check
+    // whether the first non-workspace hop is a known dev-only tool.
+    const segments = p.split('>');
+    for (const seg of segments) {
+        if (seg.startsWith('packages__'))
+            continue;
+        if (seg === '.')
+            continue;
+        if (DEV_ONLY_TOOL_ROOTS.has(seg))
+            return false;
+        // Also match scoped variants like '@vitest/coverage-v8' or
+        // '@typescript-eslint/<sub>'.
+        if (seg.startsWith('@')) {
+            const scope = seg.split('/')[0];
+            if (scope !== undefined && DEV_ONLY_TOOL_ROOTS.has(scope))
+                return false;
+        }
+        // First real dep encountered — if it's not in the dev-only list,
+        // treat this path as production-affecting.
+        return true;
+    }
+    return true;
+}
+function isProductionFinding(f) {
+    if (f.dev === true)
+        return false;
+    const paths = f.paths ?? [];
+    if (paths.length === 0)
+        return true;
+    return paths.some((p) => isPathProduction(p));
+}
+function countProductionAdvisories(audit) {
+    const counts = { critical: 0, high: 0, moderate: 0, low: 0 };
+    const advisories = audit.advisories;
+    const vulnerabilities = audit.vulnerabilities;
+    if (advisories) {
+        for (const adv of Object.values(advisories)) {
+            const sev = adv.severity ?? 'low';
+            const findings = adv.findings ?? [];
+            const isProd = findings.some((f) => isProductionFinding(f));
+            if (isProd)
+                counts[sev] += 1;
+        }
+        return counts;
+    }
+    if (vulnerabilities) {
+        for (const v of Object.values(vulnerabilities)) {
+            const sev = v.severity ?? 'low';
+            const via = v.via ?? [];
+            const isProd = via.some((entry) => typeof entry === 'string' || entry.dev !== true);
+            if (isProd)
+                counts[sev] += 1;
+        }
+        return counts;
+    }
+    // Fallback: no per-advisory detail — use the rolled-up totals.
+    const meta = audit.metadata?.vulnerabilities ?? {};
+    counts.critical = meta.critical ?? 0;
+    counts.high = meta.high ?? 0;
+    counts.moderate = meta.moderate ?? 0;
+    counts.low = meta.low ?? 0;
+    return counts;
+}
+function getNpmAuditSeverityFromCounts(counts) {
+    if (counts.critical > 0)
+        return 'critical';
+    if (counts.high > 0)
+        return 'high';
+    if (counts.moderate > 0)
+        return 'moderate';
+    return 'low';
+}
+/* v8 ignore stop */
+//# sourceMappingURL=dependency-vulnerability-audit.js.map

package/dist/checks/security/dependency-vulnerability-audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dependency-vulnerability-audit.js","sourceRoot":"","sources":["../../../src/checks/security/dependency-vulnerability-audit.ts"],"names":[],"mappings":"AAAA,+GAA+G;AAC/G;;;;;;GAMG;AAEH,OAAO,EAAE,WAAW,EAAuB,MAAM,sBAAsB,CAAC;AAExE,gFAAgF;AAChF,mBAAmB;AACnB,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,WAAW,CAAC;IACtD,EAAE,EAAE,sCAAsC;IAC1C,IAAI,EAAE,gCAAgC;IACtC,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,SAAS,CAAC,EAAE;IAE3D,UAAU,EAAE,QAAQ;IACpB,WAAW,EAAE,6DAA6D;IAC1E,eAAe,EAAE;;;;;;;;;uIASoH;IACrI,IAAI,EAAE,CAAC,UAAU,EAAE,YAAY,EAAE,SAAS,CAAC;IAC3C,SAAS,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC;IACxB,OAAO,EAAE,OAAO,EAAE,yCAAyC;IAE3D,OAAO,EAAE;QACP,qFAAqF;QACrF,GAAG,EAAE,IAAI;QACT,IAAI,EAAE;YACJ,IAAI;YACJ,wKAAwK;SACzK;QACD,iBAAiB,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,kDAAkD;QAE7E,wGAAwG;QACxG,WAAW,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS;YACpC,MAAM,UAAU,GAAqB,EAAE,CAAC;YAExC,gCAAgC;YAChC,EAAE;YACF,gEAAgE;YAChE,4DAA4D;YAC5D,gEAAgE;YAChE,gEAAgE;YAChE,kDAAkD;YAClD,IAAI,CAAC;gBA0BH,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAgB,CAAC;gBAEtD,0DAA0D;gBAC1D,yDAAyD;gBACzD,yDAAyD;gBACzD,6BAA6B;gBAC7B,MAAM,UAAU,GAAG,yBAAyB,CAAC,WAAW,CAAC,CAAC;gBAC1D,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,GAAG,UAAU,CAAC,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC;gBAE1E,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;oBACd,MAAM,QAAQ,GAAG,6BAA6B,CAAC,UAAU,CAAC,CAAC;oBAC3D,UAAU,CAAC,IAAI,CAAC;wBACd,IAAI,EAAE,CAAC;wBACP,OAAO,EAAE,mBAAmB,KAAK,uCAAuC;wBACxE,QAAQ,EAAE,QAAQ,KAAK,UAAU,IAAI,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;wBAC9E,UAAU,EACR,gPAAgP;wBAClP,IAAI,EAAE,YAAY,QAAQ,EAAE;wBAC5B,KAAK,EAAE,WAAW;wBAClB,QAAQ,EAAE,cAAc;qBACzB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,kCAAkC;YACpC,CAAC;YAED,OAAO,UAAU,CAAC;QACpB,CAAC;QACD,oBAAoB;KACrB;CACF,CAAC,CAAC;AAUH;;;;;GAKG;AACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,QAAQ;IACR,qBAAqB;IACrB,QAAQ;IACR,sBAAsB;IACtB,uBAAuB;IACvB,uBAAuB;IACvB,mCAAmC;IACnC,oBAAoB;IACpB,mBAAmB;IACnB,OAAO;IACP,MAAM;IACN,oBAAoB;IACpB,KAAK;IACL,MAAM;IACN,MAAM;IACN,OAAO;IACP,KAAK,EAAE,iDAAiD;CACzD,CAAC,CAAC;AAEH,SAAS,gBAAgB,CAAC,CAAS;IACjC,mEAAmE;IACnE,gEAAgE;IAChE,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC;YAAE,SAAS;QAC3C,IAAI,GAAG,KAAK,GAAG;YAAE,SAAS;QAC1B,IAAI,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/C,2DAA2D;QAC3D,8BAA8B;QAC9B,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAChC,IAAI,KAAK,KAAK,SAAS,IAAI,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;QAC1E,CAAC;QACD,iEAAiE;QACjE,2CAA2C;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,mBAAmB,CAAC,CAA+C;IAC1E,IAAI,CAAC,CAAC,GAAG,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACjC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;IAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;AAChD,CAAC;AAUD,SAAS,yBAAyB,CAAC,KAYlC;IACC,MAAM,MAAM,GAAwB,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IAClF,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;IACpC,MAAM,eAAe,GAAG,KAAK,CAAC,eAAe,CAAC;IAE9C,IAAI,UAAU,EAAE,CAAC;QACf,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5C,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,IAAI,KAAK,CAAC;YAClC,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5D,IAAI,MAAM;gBAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI,eAAe,EAAE,CAAC;QACpB,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC;YAC/C,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,IAAI,KAAK,CAAC;YAChC,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC;YACxB,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;YACpF,IAAI,MAAM;gBAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,+DAA+D;IAC/D,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,EAAE,eAAe,IAAI,EAAE,CAAC;IACnD,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC;IACrC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC;IAC7B,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC;IACrC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;IAC3B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,6BAA6B,CAAC,MAA2B;IAChE,IAAI,MAAM,CAAC,QAAQ,GAAG,CAAC;QAAE,OAAO,UAAU,CAAC;IAC3C,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC;IACnC,IAAI,MAAM,CAAC,QAAQ,GAAG,CAAC;QAAE,OAAO,UAAU,CAAC;IAC3C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,oBAAoB"}

package/dist/checks/security/env-secret-exposure.d.ts

@@ -0,0 +1,11 @@
+/**
+ * @fileoverview Detect secrets exposed through env vars in logs/errors
+ */
+/**
+ * Check: security/env-secret-exposure
+ *
+ * Detects secrets that might be exposed through environment variables
+ * in logs or error messages.
+ */
+export declare const envSecretExposure: import("@opensip-cli/fitness").Check;
+//# sourceMappingURL=env-secret-exposure.d.ts.map

package/dist/checks/security/env-secret-exposure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-secret-exposure.d.ts","sourceRoot":"","sources":["../../../src/checks/security/env-secret-exposure.ts"],"names":[],"mappings":"AAIA;;GAEG;AAyEH;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,sCA+D5B,CAAC"}